↳ GitHub sourceAnalytics ruleMedium

Disabling Security Services via Registry

Description

This query checks for processes modifying the registry to disable security features. This is a common technique used by threat actors for defence evasion.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

DefenseEvasion T1562

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

MicrosoftThreatProtection

Data types

DeviceProcessEvents

KQL query

Original query, unchanged.

DeviceProcessEvents
| where InitiatingProcessCommandLine has_all(@'"reg"', 'add', @'"HKLM\SOFTWARE\Policies\', '/v','/t', 'REG_DWORD', '/d', '/f')
  and InitiatingProcessCommandLine has_any('DisableRealtimeMonitoring', 'UseTPMKey', 'UseTPMKeyPIN', 'UseAdvancedStartup', 
  'EnableBDEWithNoTPM', 'RecoveryKeyMessageSource')
| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")

Declared entities

HostAccountProcess

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Microsoft Defender XDR/Analytic Rules/Ransomware/DEV-0270/DisableSecurityServiceViaRegistry.yaml ↗
Commit: 9800e51 ↗
Source identifier: 32b29155-3fd3-4a9e-a0ca-a67e2593b60b

Additional source files 2

Solutions/Microsoft Defender XDR/Analytic Rules/Ransomware/DEV-0270/DisableSecurityServiceViaRegistry.yamlsource ↗Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.